fad-checker 2.1.2 → 2.2.1

package/lib/codecs/ruby.codec.js

@@ -14,7 +14,7 @@ const R = require("./ruby/parse");
 
 const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "vendor", "tmp"]);
 
-function findGemfileLocks(dir) {
+function findGemfileLocks(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const found = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -22,12 +22,16 @@ function findGemfileLocks(dir) {
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		for (const e of entries) {
 			if (e.isFile() && e.name === "Gemfile.lock") found.push(path.join(cur, e.name));
-			else if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+			else if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 		}
 	}
 	return found;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "ruby",
 	label: "Ruby",
@@ -40,7 +44,7 @@ module.exports = {
 		const { deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
-		for (const fp of findGemfileLocks(dir)) {
+		for (const fp of findGemfileLocks(dir, dirFilter(dir, opts))) {
 			try {
 				const { deps } = R.parseGemfileLockFile(fp);
 				for (const d of deps) {

package/lib/config.js

@@ -44,35 +44,45 @@ function getNvdApiKey() {
 }
 
 /**
- * Custom Maven repositories (Nexus, Artifactory, JBoss, …) the user has
- * configured. Returned as an array of { name, url, auth? } where `auth` is
- * pre-encoded "user:pass" (caller wraps as Basic <base64>).
+ * Per-ecosystem custom registries (Nexus/Artifactory/JBoss, Verdaccio, devpi,
+ * Gemfury, Athens, …) the user has configured. Stored under config key
+ * `registries`: { <ecosystem>: [{ name, url, auth?, token? }] } where `auth` is
+ * "user:pass" (→ Basic) and `token` is a Bearer token.
  *
- * Maven Central is intentionally NOT included here — callers append it as
- * the final fallback. That keeps the user's repos in priority order while
- * always ensuring Central works as a safety net.
+ * Public registries (Maven Central, registry.npmjs.org, …) are intentionally
+ * NOT stored here — callers append them as the final fallback so the user's
+ * registries stay in priority order while the public one is always a safety net.
  */
-function getMavenRepos() {
-	const list = get("maven_repos") || [];
+function getRegistryMap() {
+	const m = get("registries");
+	return (m && typeof m === "object" && !Array.isArray(m)) ? m : {};
+}
+
+function getRegistries(ecosystem) {
+	const list = getRegistryMap()[ecosystem];
 	return Array.isArray(list) ? list : [];
 }
 
-function setMavenRepos(list) {
-	return set("maven_repos", Array.isArray(list) && list.length ? list : null);
+function setRegistryMap(map) {
+	return set("registries", map && Object.keys(map).length ? map : null);
 }
 
-function addMavenRepo(name, url, auth = null) {
-	const list = getMavenRepos().filter(r => r.name !== name);
-	list.push({ name, url, ...(auth ? { auth } : {}) });
-	setMavenRepos(list);
+function addRegistry(ecosystem, name, url, { auth = null, token = null } = {}) {
+	const map = getRegistryMap();
+	const list = (map[ecosystem] || []).filter(r => r.name !== name);
+	list.push({ name, url, ...(auth ? { auth } : {}), ...(token ? { token } : {}) });
+	map[ecosystem] = list;
+	setRegistryMap(map);
 	return list;
 }
 
-function removeMavenRepo(name) {
-	const before = getMavenRepos();
-	const after = before.filter(r => r.name !== name);
-	setMavenRepos(after);
-	return before.length !== after.length;
+function removeRegistry(ecosystem, name) {
+	const map = getRegistryMap();
+	const before = (map[ecosystem] || []).length;
+	map[ecosystem] = (map[ecosystem] || []).filter(r => r.name !== name);
+	if (!map[ecosystem].length) delete map[ecosystem];
+	setRegistryMap(map);
+	return before !== (map[ecosystem]?.length || 0);
 }
 
 module.exports = {
@@ -83,8 +93,9 @@ module.exports = {
 	set,
 	get,
 	getNvdApiKey,
-	getMavenRepos,
-	setMavenRepos,
-	addMavenRepo,
-	removeMavenRepo,
+	getRegistryMap,
+	getRegistries,
+	setRegistryMap,
+	addRegistry,
+	removeRegistry,
 };

package/lib/core.js

@@ -19,7 +19,9 @@ const SKIP_DIRS = new Set([
 
 const coord = v => (v == null ? null : String(v).trim() || null);
 
-function findPomFiles(dir) {
+const defaultPomSkip = child => SKIP_DIRS.has(path.basename(child));
+
+function findPomFiles(dir, skipDir = defaultPomSkip) {
 	const out = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -29,8 +31,9 @@ function findPomFiles(dir) {
 		catch { continue; }
 		for (const e of entries) {
 			if (e.isDirectory()) {
-				if (SKIP_DIRS.has(e.name)) continue;
-				stack.push(path.join(cur, e.name));
+				const child = path.join(cur, e.name);
+				if (skipDir(child, e.name)) continue;
+				stack.push(child);
 			} else if (e.name === "pom.xml") {
 				out.push(path.join(cur, e.name));
 			}
@@ -41,11 +44,11 @@ function findPomFiles(dir) {
 
 // Parallel equivalent of findPomFiles — same result, but readdir runs concurrently
 // so the walk isn't serialized one round-trip at a time on a high-latency filesystem.
-async function findPomFilesAsync(dir) {
+async function findPomFilesAsync(dir, skipDir = defaultPomSkip) {
 	const { walkDirs } = require("./parallel-walk");
 	const out = [];
 	await walkDirs(dir, {
-		skipDir: name => SKIP_DIRS.has(name),
+		skipDir,
 		onDir: (cur, entries) => {
 			for (const e of entries) if (e.isFile() && e.name === "pom.xml") out.push(path.join(cur, e.name));
 		},
@@ -359,6 +362,7 @@ async function rewritePoms(pomPath, allPomMetadata, allPropsByPom, opts) {
 
 module.exports = {
 	coord,
+	SKIP_DIRS,
 	findPomFiles,
 	findPomFilesAsync,
 	newMetadataStore,

package/lib/cve-match.js

@@ -125,14 +125,14 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 		// Embedded-binary coords don't participate in Maven Central resolution (a
 		// fat-jar already ships its deps, discovered by recursion) and must not act as
 		// a depMgmt override for the declared tree.
-		if (dep.provenance === "embedded") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
 		if (dep.version && !/\$\{/.test(dep.version)) {
 			rootDepMgmt.set(`${dep.groupId}:${dep.artifactId}`, { version: dep.version });
 		}
 	}
 
 	const directs = [...resolvedDeps.values()]
-		.filter(d => d.provenance !== "embedded")
+		.filter(d => d.provenance !== "embedded" && d.provenance !== "binary")
 		.filter(d => d.version && !/\$\{/.test(d.version))
 		.filter(d => d.scope !== "test" || opts.includeTestDeps)
 		.filter(d => d.scope !== "parent");
@@ -227,6 +227,7 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 		// They are caught by the OSV pipeline (which is multi-ecosystem) and
 		// the CPE refinement step (post-NVD).
 		if (dep.ecosystem === "npm") continue;
+		if (dep.provenance === "binary") continue; // no resolved coordinate yet (Plan 2 identifies it)
 		const key = `${dep.groupId}:${dep.artifactId}`.toLowerCase();
 		// Tier 1: exact packageName match
 		const t1 = matchOne(dep, byPackage[key], "exact");

package/lib/cve-report.js

@@ -12,6 +12,8 @@ const fs = require("fs");
 const path = require("path");
 const { getCodec, allCodecs, ORDER } = require("./codecs");
 const { computePriority, sortByPriority } = require("./priority");
+const { buildInventory } = require("./unmanaged");
+const { buildEmbeddedInventory } = require("./embedded");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -934,17 +936,42 @@ function renderRecommendationsForEco(slice, meta) {
 	return blocks.join("");
 }
 
+// Where a dependency comes from in the tree. A transitive dep (no defining
+// manifest) carries `via` — the chain of g:a from a root direct dep down to it —
+// recorded by the transitive resolver. Show that chain so an EOL/CVE finding on a
+// "dep of a dep" is traceable to the direct dependency that pulls it in. A direct
+// dep falls back to its defining manifest(s).
+function renderDepOrigin(dep, srcRoot) {
+	if (dep.via && dep.via.length) {
+		const chain = dep.via.map(c => `<code>${esc(c)}</code>`).join(" → ");
+		const tail = `<code>${esc(`${dep.groupId}:${dep.artifactId}`)}</code>`;
+		const alt = (dep.viaPaths && dep.viaPaths.length > 1) ? ` <span class="defined-more">+${dep.viaPaths.length - 1} more path${dep.viaPaths.length > 2 ? "s" : ""}</span>` : "";
+		return `<div class="defined-in"><span class="defined-label">pulled in via:</span> ${chain} → ${tail}${alt}</div>`;
+	}
+	return renderDefinedIn(dep, srcRoot);
+}
+
+// The source of an EOL verdict: the endoflife.date product queried, and which
+// mapping rule (data/eol-mapping.json) matched the dep to that product.
+function renderEolSource(e) {
+	const slug = e.productSlug || "";
+	const link = slug ? `endoflife.date/${esc(slug)}` : "endoflife.date";
+	const rule = e.via ? `<br><span style="color:#6b7280">matched via ${esc(e.via)} = <code>${esc(e.viaKey || "")}</code></span>` : "";
+	return `<span>${link}</span>${rule}`;
+}
+
 function renderEolTable(eolResults) {
 	if (!eolResults?.length) return `<div class="empty">No end-of-life frameworks detected.</div>`;
 	const rows = eolResults.map(e => `<tr>
 		<td class="dep">${esc(e.product)}</td>
-		<td class="dep">${esc(depDisplayName(e.dep))}<br><span style="color:#6b7280">${esc(e.dep.version || "?")}</span>${renderDefinedIn(e.dep, RENDER_CTX.srcRoot)}</td>
+		<td class="dep">${esc(depDisplayName(e.dep))}<br><span style="color:#6b7280">${esc(e.dep.version || "?")}</span>${renderDepOrigin(e.dep, RENDER_CTX.srcRoot)}</td>
 		<td>${esc(e.eol || "")}</td>
 		<td>${esc(e.latest || "")}</td>
+		<td class="dep">${renderEolSource(e)}</td>
 		<td class="desc">${esc(e.notes || "")}</td>
 	</tr>`).join("\n");
 	return `<table>
-		<thead><tr><th>Product</th><th>Dependency</th><th>EOL date</th><th>Latest</th><th>Notes</th></tr></thead>
+		<thead><tr><th>Product</th><th>Dependency</th><th>EOL date</th><th>Latest</th><th>Source</th><th>Notes</th></tr></thead>
 		<tbody>${rows}</tbody>
 	</table>`;
 }
@@ -1337,7 +1364,7 @@ const LICENSE_CAT_ORDER = ["network-copyleft", "strong-copyleft", "proprietary",
 
 function renderLicenseChapter(licenseResults) {
 	if (!licenseResults || !licenseResults.assessed?.length) {
-		return `<div class="empty">No license data resolved (offline, or registries returned none).</div>`;
+		return `<div class="empty">No license data — the license scan is off by default (enable with <code>--licenses</code>); also empty when offline or registries return none.</div>`;
 	}
 	const { byCategory } = licenseResults;
 	const blocks = LICENSE_CAT_ORDER.filter(cat => byCategory[cat]?.length).map(cat => {
@@ -1362,7 +1389,7 @@ function renderLicenseChapter(licenseResults) {
 	return intro + blocks;
 }
 
-function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches      = mergeMatches(cveMatches || []);
@@ -1396,7 +1423,12 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	const licenseContent   = renderLicenseChapter(licenseResults);
 	const licenseTotal     = licenseResults?.assessed?.length || 0;
 	const licenseFlagged   = licenseResults?.flagged?.length || 0;
-	const embeddedContent  = renderEmbeddedChapter(embMatchesActive, projectInfo?.src);
+	const embeddedInventory = buildEmbeddedInventory(resolvedDeps || new Map(), embMatchesActive);
+	const embeddedContent  = renderEmbeddedChapter(embeddedInventory, embMatchesActive, projectInfo?.src);
+	const unmanagedInventory = buildInventory(resolvedDeps || new Map());
+	const unmanagedContent = renderUnmanagedInventory(unmanagedInventory, projectInfo?.src);
+	const vendoredJsInv    = vendoredJsInventory || [];
+	const vendoredJsContent = renderVendoredJsInventory(vendoredJsInv, projectInfo?.src);
 	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP, ...embMatchesFP]);
 
 	const toolbar = `<div class="toolbar">
@@ -1428,7 +1460,9 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		outdatedTotal: outdatedResults?.length || 0,
 		licenseTotal,
 		licenseFlagged,
-		embeddedTotal: embStats.total,
+		embeddedTotal: embeddedInventory.length,
+		unmanagedTotal: unmanagedInventory.length,
+		vendoredJsTotal: vendoredJsInv.length,
 		fpTotal: prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length,
 	});
 
@@ -1448,7 +1482,9 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 
 		${(warnings?.length || 0) ? majorSection(`0. Warnings & scan-completeness (${warnings.length})`, renderWarnings(warnings), { open: true, id: "ch0" }) : ""}
 		${majorSection(`1. CVE Vulnerabilities — production (${prodStats.total})`, cveContent, { id: "ch1" })}
-		${embStats.total ? majorSection(`1B. Embedded binaries — JAR/WAR/EAR (${embStats.total})`, embeddedContent, { open: embStats.total <= 50, id: "ch1e" }) : ""}
+		${embeddedInventory.length ? majorSection(`1B. Embedded binaries — JAR/WAR/EAR (${embeddedInventory.length})`, embeddedContent, { open: embeddedInventory.length <= 50, id: "ch1e" }) : ""}
+		${unmanagedInventory.length ? majorSection(`1C. Unmanaged / vendored binaries (${unmanagedInventory.length})`, unmanagedContent, { open: unmanagedInventory.length <= 50, id: "ch1c" }) : ""}
+		${vendoredJsInv.length ? majorSection(`1D. Unmanaged / vendored JavaScript (${vendoredJsInv.length})`, vendoredJsContent, { open: vendoredJsInv.length <= 50, id: "ch1d" }) : ""}
 		${majorSection(`2. Vendored JS scan — retire.js (${retireMatches.length})`, vendoredContent, { open: retireMatches.length > 0 && retireMatches.length <= 50, id: "ch2" })}
 		${majorSection(`3. CVE in dev dependencies (${devStats.total})`, devCveContent, { open: devStats.total > 0 && devStats.total <= 50, id: "ch3" })}
 		${majorSection(`4. End-of-Life Frameworks (${eolResults?.length || 0})`, renderEolTable(eolResults), { id: "ch4" })}
@@ -1493,12 +1529,14 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	return out;
 }
 
-function renderToc({ hasWarnings, prodTotal, embeddedTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
+function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
 	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
 	if (embeddedTotal)                entries.push({ id: "ch1e", label: `1B. Embedded (${embeddedTotal})` });
-	entries.push({ id: "ch2", label: `2. Vendored JS (${retireTotal})` });
+	if (unmanagedTotal)               entries.push({ id: "ch1c", label: `1C. Unmanaged (${unmanagedTotal})` });
+	if (vendoredJsTotal)              entries.push({ id: "ch1d", label: `1D. Vendored JS (${vendoredJsTotal})` });
+	entries.push({ id: "ch2", label: `2. Vendored JS vulns (${retireTotal})` });
 	entries.push({ id: "ch3", label: `3. Dev CVE (${devTotal})` });
 	entries.push({ id: "ch4", label: `4. EOL (${eolTotal})` });
 	entries.push({ id: "ch5", label: `5. Obsolete (${obsoleteTotal})` });
@@ -1509,25 +1547,82 @@ function renderToc({ hasWarnings, prodTotal, embeddedTotal, retireTotal, devTota
 	return `<nav class="toc">${entries.map(e => `<a href="#${e.id}">${esc(e.label)}</a>`).join("")}</nav>`;
 }
 
-// Embedded-binary CVE chapter: group findings by their top-level archive (the
-// part of the manifestPath before the first "!/"), so a fat-jar lists all the
-// vulnerable libraries shaded inside it.
-function renderEmbeddedChapter(matches, srcRoot) {
-	if (!matches.length) return `<div class="empty">No CVEs found in embedded binaries.</div>`;
-	const intro = `<div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars) — not declared in any <code>pom.xml</code>. Patch by rebuilding/replacing the containing archive.</div>`;
+// Embedded-binary inventory chapter (1B): every embedded coordinate grouped by its
+// top-level archive (the part of the manifestPath before the first "!/"), with its
+// CVE status. Vulnerable coords additionally get the full CVE detail table.
+function renderEmbeddedChapter(inventory, embeddedMatches, srcRoot) {
+	if (!inventory.length) return `<div class="empty">No embedded JAR/WAR/EAR coordinates found.</div>`;
+	const vulnN = inventory.filter(e => e.vulnCount > 0).length;
+	const intro = `<div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars, shaded uber-jars) — <strong>not declared in any <code>pom.xml</code></strong>. Unmanaged third-party code: unknown provenance and patch story even when not vulnerable. <strong>${vulnN}</strong> of ${inventory.length} carry known CVEs (patch by rebuilding/replacing the containing archive).</div>`;
+	// CVE matches keyed by archive, for the per-archive detail tables.
+	const matchesByArchive = new Map();
+	for (const m of (embeddedMatches || [])) {
+		const top = String((m.dep?.manifestPaths || [])[0] || "(unknown archive)").split("!/")[0];
+		if (!matchesByArchive.has(top)) matchesByArchive.set(top, []);
+		matchesByArchive.get(top).push(m);
+	}
 	const byArchive = new Map();
-	for (const m of matches) {
-		const mp = (m.dep?.manifestPaths || [])[0] || "(unknown archive)";
-		const top = String(mp).split("!/")[0];
-		if (!byArchive.has(top)) byArchive.set(top, []);
-		byArchive.get(top).push(m);
+	for (const e of inventory) {
+		if (!byArchive.has(e.archive)) byArchive.set(e.archive, []);
+		byArchive.get(e.archive).push(e);
 	}
-	const blocks = [...byArchive.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([archive, list]) =>
-		minorSection(`📦 <code class="path">${esc(archive)}</code> (${list.length})`, renderCveTable(list), { open: list.length <= 30 })
-	).join("\n");
+	const blocks = [...byArchive.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([archive, list]) => {
+		const rows = list.map(e => {
+			const coord = `${e.groupId}:${e.artifactId}:${e.version}`;
+			const status = e.vulnCount > 0
+				? pill(`${e.vulnCount} CVE${e.vulnCount > 1 ? "s" : ""}${e.maxSeverity ? " · " + e.maxSeverity : ""}`, "#b91c1c")
+				: pill("no known CVE", "#15803d");
+			return `<tr><td class="dep"><code>${esc(coord)}</code></td><td>${status}</td></tr>`;
+		}).join("\n");
+		const invTable = `<table><thead><tr><th>Coordinate (groupId:artifactId:version)</th><th>Status</th></tr></thead><tbody>${rows}</tbody></table>`;
+		const cveDetail = matchesByArchive.has(archive)
+			? `<div class="defined-in" style="margin-top:8px"><span class="defined-label">CVE detail:</span></div>` + renderCveTable(matchesByArchive.get(archive))
+			: "";
+		return minorSection(`📦 <code class="path">${esc(archive)}</code> (${list.length})`, invTable + cveDetail, { open: list.length <= 30 });
+	}).join("\n");
 	return intro + blocks;
 }
 
+// Unmanaged native-binary inventory (Part C). Committed .dll/.exe/.so/.dylib that no
+// package manager governs, identified by checksum (deps.dev + CIRCL). Self-contained
+// inline styles, matching the report's no-external-CSS philosophy.
+function pill(text, bg, fg = "#fff") {
+	return `<span style="display:inline-block;padding:2px 8px;border-radius:3px;background:${bg};color:${fg};font-weight:600;font-size:11px">${esc(text)}</span>`;
+}
+function renderUnmanagedInventory(inventory, srcRoot) {
+	if (!inventory.length) return `<div class="empty">No committed native binaries found.</div>`;
+	const intro = `<div class="fp-intro">Committed native binaries (<code>.dll</code>/<code>.exe</code>/<code>.so</code>/<code>.dylib</code>) — not governed by any package manager. Identified by checksum (deps.dev + CIRCL). <strong>should-be-managed</strong> = a published package committed as a blob; <strong>name≠checksum</strong> = the filename disagrees with what the hash resolves to; <strong>not recognised by any source</strong> = neither deps.dev nor CIRCL knows this exact file (vendored/custom build — verify its origin manually). Identification is by checksum only; a file absent from both databases stays unidentified even when its name is suggestive (e.g. <code>openssl.exe</code>).</div>`;
+	const rows = inventory.map(e => {
+		let rel = e.path;
+		if (srcRoot) { try { rel = path.relative(srcRoot, e.path); } catch { /* keep abs */ } }
+		const id = e.identity
+			? `${esc(e.identity.ecosystem ? e.identity.ecosystem + ":" : "")}${esc(e.identity.name || "")}${e.identity.version ? "@" + esc(e.identity.version) : ""} <span style="color:#6b7280">(${esc(e.identity.source || "")})</span>`
+			: `<span style="color:#6b7280">unknown</span>`;
+		const flags = [
+			e.knownMalicious ? pill("⚠ MALICIOUS", "#7c0008") : null,
+			e.integrity === "pristine" ? pill("pristine", "#166534") : (e.integrity === "known-good" ? pill("known-good", "#15803d") : null),
+			e.shouldBeManaged ? pill("should-be-managed", "#2563eb") : null,
+			e.nameMismatch ? pill("name≠checksum", "#ea580c") : null,
+			e.noOnlineInfo ? pill("not recognised by any source", "#6b7280") : null,
+		].filter(Boolean).join(" ");
+		return `<tr><td class="dep"><code class="path">${esc(rel)}</code></td><td>${id}</td><td>${flags}</td><td><code class="path" style="color:#6b7280">${esc((e.hashes?.sha256 || "").slice(0, 16))}…</code></td></tr>`;
+	}).join("\n");
+	return intro + `<table><thead><tr><th>File</th><th>Identity (by checksum)</th><th>Status</th><th>SHA-256</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
+function renderVendoredJsInventory(inventory, srcRoot) {
+	if (!inventory || !inventory.length) return `<div class="empty">No vendored JavaScript libraries identified.</div>`;
+	const vulnN = inventory.filter(e => e.vulnerable).length;
+	const intro = `<div class="fp-intro">Standalone JavaScript libraries committed into the tree (jQuery, Bootstrap, PDF.js, …) that <strong>no package manager governs</strong> — unknown provenance, integrity and patch story, identified by signature (retire.js). This is a cyber-hygiene inventory: even a non-vulnerable copy is unmanaged third-party code. <strong>${vulnN}</strong> of ${inventory.length} carry known vulnerabilities (detailed in chapter 2).</div>`;
+	const rows = inventory.map(e => {
+		const sevPill = e.vulnerable
+			? pill(`${e.vulnCount} vuln${e.vulnCount > 1 ? "s" : ""}${e.maxSeverity ? " · " + e.maxSeverity : ""}`, "#b91c1c")
+			: pill("no known vuln", "#15803d");
+		return `<tr><td>${esc(e.component || "?")}</td><td>${esc(e.version || "?")}</td><td class="dep"><code class="path">${esc(e.file || "")}</code></td><td><span style="color:#6b7280">${esc(e.detection || "")}</span></td><td>${sevPill}</td></tr>`;
+	}).join("\n");
+	return intro + `<table><thead><tr><th>Library</th><th>Version</th><th>File</th><th>Detection</th><th>Status</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
 function renderFalsePositives(matches) {
 	if (!matches.length) return `<div class="empty">No CPE-filtered findings.</div>`;
 	const intro = `<div class="fp-intro">These entries were initially matched by name but NVD's CPE configurations show your dep version is outside every vulnerable range. They are almost certainly false positives — kept here for audit transparency.</div>`;
@@ -1911,12 +2006,12 @@ ${WORD_SECTION_PR}
 // Render the HTML and/or Word report. Callers pass explicit target paths;
 // a null/omitted path skips that format (so `--report-html` alone writes only HTML).
 // Back-compat: `outputDir` still writes both under the default file names.
-async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
 	if (outputDir) {
 		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
 		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
 	}
-	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
 	const written = { htmlPath: null, docPath: null };
 	if (htmlPath) {
 		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });
@@ -1933,6 +2028,7 @@ async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retire
 
 module.exports = {
 	computeStats,
+	buildEmbeddedInventory,
 	generateHtmlReport,
 	generateWordReport,
 	writeReports,

package/lib/dep-record.js

@@ -35,17 +35,18 @@ function coordKeyFor(ecosystem, namespace, name) {
 }
 
 function makeDepRecord(input) {
-	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType, provenance = "manifest" } = input;
+	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType, provenance = "manifest", hashes = null, declaredName = null } = input;
 	const concrete = version && !/\$\{/.test(version) ? version : null;
 	const manifestPaths = manifestPath ? [manifestPath] : [];
-	// Embedded binaries (a dep discovered INSIDE a .jar/.war/.ear, not declared in a
-	// manifest) must not share the Map key of a declared dep with the same g:a — else
-	// they'd merge and the "embedded binaries" report chapter would lose them. Key
-	// them by their unique physical location instead. provenance stays on the record
-	// so the report/exports can label & group them; "both" is set later if a merge
-	// across provenances ever happens.
-	const coordKey = provenance === "embedded" && manifestPath
-		? `embedded:${manifestPath}`
+	// Embedded binaries (a dep discovered INSIDE a .jar/.war/.ear) and standalone
+	// committed native binaries (.dll/.so/…) must not share the Map key of a declared
+	// dep with the same coordinate — they'd merge and the unmanaged report chapter
+	// would lose them. Key them by their unique physical location instead. provenance
+	// stays on the record so the report/exports can label & group them; "both" is set
+	// later if a merge across provenances ever happens.
+	const byLocation = (provenance === "embedded" || provenance === "binary") && manifestPath;
+	const coordKey = byLocation
+		? `${provenance}:${manifestPath}`
 		: coordKeyFor(ecosystem, namespace, name);
 	return {
 		ecosystem,
@@ -56,6 +57,8 @@ function makeDepRecord(input) {
 		versions: concrete ? [concrete] : [],
 		coordKey,
 		provenance,
+		hashes,
+		declaredName,
 		scope,
 		isDev: !!isDev,
 		manifestPaths,

package/lib/embedded.js

@@ -0,0 +1,57 @@
+/**
+ * lib/embedded.js — inventory of Maven coordinates discovered inside committed
+ * .jar/.war/.ear archives (provenance:"embedded"), whether or not they carry a CVE.
+ *
+ * This is a governance / cyber-hygiene signal: the JAR twin of the native-binary
+ * inventory (lib/unmanaged.js → chapter 1C) and the vendored-JS inventory
+ * (lib/retire.js → chapter 1D). Code that ships inside a committed binary which no
+ * pom.xml declares has unknown provenance and patch story even when not vulnerable.
+ *
+ * Pure: shared by the HTML report (chapter 1B) and the JSON export so both list the
+ * SAME set. CVE counts/severity are cross-referenced from the embedded CVE matches
+ * by coordKey.
+ */
+
+const EMB_SEV_RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
+
+/**
+ * @param resolvedDeps Map of all resolved deps (embedded ones carry provenance:"embedded").
+ * @param embeddedMatches CVE matches whose dep is embedded (subset of the scan's matches).
+ * @returns sorted array of { archive, groupId, artifactId, version, coordKey, manifestPath, vulnCount, maxSeverity }
+ */
+function buildEmbeddedInventory(resolvedDeps, embeddedMatches) {
+	const cveByCoord = new Map(); // coordKey → { ids:Set, maxSeverity }
+	for (const m of (embeddedMatches || [])) {
+		const key = m.dep?.coordKey;
+		if (!key) continue;
+		let e = cveByCoord.get(key);
+		if (!e) { e = { ids: new Set(), maxSeverity: null }; cveByCoord.set(key, e); }
+		e.ids.add(m.cve?.id);
+		const sev = m.cve?.severity || "UNKNOWN";
+		if (!e.maxSeverity || (EMB_SEV_RANK[sev] || 0) > (EMB_SEV_RANK[e.maxSeverity] || 0)) e.maxSeverity = sev;
+	}
+	const out = [];
+	for (const dep of (resolvedDeps?.values?.() || [])) {
+		if (dep.provenance !== "embedded") continue;
+		const manifestPath = (dep.manifestPaths || [])[0] || "(unknown archive)";
+		const archive = String(manifestPath).split("!/")[0];
+		const cve = cveByCoord.get(dep.coordKey);
+		out.push({
+			archive,
+			groupId: dep.groupId || dep.namespace || "",
+			artifactId: dep.artifactId || dep.name || "",
+			version: dep.version || "",
+			coordKey: dep.coordKey,
+			manifestPath,
+			vulnCount: cve ? cve.ids.size : 0,
+			maxSeverity: cve ? cve.maxSeverity : null,
+		});
+	}
+	out.sort((a, b) =>
+		(EMB_SEV_RANK[b.maxSeverity] || 0) - (EMB_SEV_RANK[a.maxSeverity] || 0)
+		|| String(a.archive).localeCompare(String(b.archive))
+		|| `${a.groupId}:${a.artifactId}:${a.version}`.localeCompare(`${b.groupId}:${b.artifactId}:${b.version}`));
+	return out;
+}
+
+module.exports = { buildEmbeddedInventory, EMB_SEV_RANK };

package/lib/hash-id.js

@@ -0,0 +1,78 @@
+/**
+ * lib/hash-id.js — identity-by-checksum for unmanaged artifacts.
+ *
+ * Two known-good sources, tried in order:
+ *  1. deps.dev query-by-hash → exact package coordinate (whole published archive).
+ *  2. CIRCL hashlookup → known OS/distro/CDN/NSRL file + free KnownMalicious flag.
+ *
+ * Cache-backed (~/.fad-checker/hash-id-cache.json, 24h) and --offline-aware: offline
+ * reads cache only and never touches the network (project air-gapped principle).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "hash-id-cache.json");
+const CACHE_TTL_MS = 24 * 3600 * 1000;
+const DEPSDEV = "https://api.deps.dev/v3/query";
+const CIRCL = "https://hashlookup.circl.lu/lookup/sha256";
+
+const SYSTEM_TO_ECO = { MAVEN: "maven", NPM: "npm", NUGET: "nuget", PYPI: "pypi", RUBYGEMS: "ruby", CARGO: "cargo", GO: "go" };
+
+function sha1ToBase64(hex) { return Buffer.from(hex, "hex").toString("base64"); }
+
+function parseDepsDev(body) {
+	const vk = body?.results?.[0]?.version?.versionKey;
+	if (!vk?.name) return null;
+	return { ecosystem: SYSTEM_TO_ECO[vk.system] || (vk.system || "").toLowerCase() || null, name: vk.name, version: vk.version || null, source: "deps.dev" };
+}
+
+function parseCircl(body) {
+	if (!body || body.message || !(body.FileName || body.ProductCode)) return null;
+	const malicious = Array.isArray(body.KnownMalicious) ? body.KnownMalicious.length > 0 : !!body.KnownMalicious;
+	return {
+		ecosystem: null,
+		name: body.ProductCode?.ProductName || body.FileName || null,
+		version: body.ProductCode?.ProductVersion || null,
+		source: `circl:${body.db || "hashlookup"}`,
+		trust: body["hashlookup:trust"] != null ? body["hashlookup:trust"] : null,
+		knownMalicious: malicious,
+	};
+}
+
+function loadCache() { try { const d = JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); if (Date.now() - (d._fetchedAt || 0) < CACHE_TTL_MS) return d.entries || {}; } catch { /* ignore */ } return {}; }
+function saveCache(entries) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify({ _fetchedAt: Date.now(), entries })); } catch { /* ignore */ } }
+
+async function lookupHash(hashes, opts = {}) {
+	const { fetcher = globalThis.fetch, offline = false, cache } = opts;
+	const entries = cache || loadCache();
+	const key = hashes.sha256 || hashes.sha1;
+	if (!key) return null;
+	if (Object.prototype.hasOwnProperty.call(entries, key)) return entries[key];
+	if (offline) return null;
+
+	let identity = null;
+	// 1) deps.dev (SHA1 base64)
+	if (hashes.sha1) {
+		try {
+			const r = await fetcher(`${DEPSDEV}?hash.type=SHA1&hash.value=${encodeURIComponent(sha1ToBase64(hashes.sha1))}`, { headers: { "User-Agent": "fad-checker-hashid" } });
+			if (r.ok) identity = parseDepsDev(await r.json());
+		} catch { /* ignore, try CIRCL */ }
+	}
+	// 2) CIRCL (SHA-256)
+	if (!identity && hashes.sha256) {
+		try {
+			const r = await fetcher(`${CIRCL}/${hashes.sha256}`, { headers: { "User-Agent": "fad-checker-hashid", Accept: "application/json" } });
+			if (r.ok) identity = parseCircl(await r.json());
+		} catch { /* ignore */ }
+	}
+	entries[key] = identity;
+	if (!cache) saveCache(entries);
+	return identity;
+}
+
+module.exports = { sha1ToBase64, parseDepsDev, parseCircl, lookupHash, loadCache, saveCache, CACHE_PATH };